CVE-2026-2239 Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow

What is CVE-2026-2239?

CVE-2026-2239 is a low-severity memory corruption vulnerability in Gimp Gimp, published on 26 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread_pascal_string function when processing a specially crafted PSD (Photoshop Document) file. This occurs because the buffer allocated for a Pascal string is not properly null-terminated, leading to an out-of-bounds read when strlen() is subsequently called. Successfully exploiting this vulnerability can cause the application to crash, resulting in an application level Denial of Service.

Weakness: CWE-170

Which versions are affected by CVE-2026-2239?

It affects 2 products.

Products include Gimp Gimp, Redhat Enterprise Linux.

How do I fix CVE-2026-2239?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-2239 being exploited?

There is no known exploitation of CVE-2026-2239 in the wild and no public exploit code.

Other vulnerabilities in Gimp Gimp

• CVE-2010-4541 Memory corruption in n/a Critical 9.3
• CVE-2009-3909 Integer overflow in n/a Critical 9.3
• CVE-2009-1570 Integer overflow in n/a Critical 9.3
• CVE-2009-0723 Integer overflow in n/a Critical 9.3
• CVE-2009-0733 Memory corruption in n/a Critical 9.3

All Gimp Gimp vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-2239, GHSA-pjv8-58qr-6mxx, UBUNTU-CVE-2026-2239, openSUSE-SU-2026:10195-1, openSUSE-SU-2026:20275-1.